ClawHub
Back to skill

Security audit

Tmp.6wLATFVyAx

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent setlist.fm MCP integration, with ordinary setup risks from installing an unpinned npm package and storing an API key.

Before installing, prefer pinning `setlist-mcp` to a reviewed version or commit, keep `SETLIST_API_KEY` out of committed files, and use project-level MCP configuration unless you intentionally want the server available globally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis
Remediation
View remediation
"] ``` Do not use version ranges or implicit `latest` resolution. 2. Prefer a controlled local installation with a committed `package-lock.json`, then install using: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are genuinely required, audit them and enable them only for the reviewed package and dependency versions. 3. For source installations, check out a verified release tag or immutable commit hash rather than executing the repository's current default branch: ```bash git checkout ``` 4. Verify release provenance, npm integrity metadata, maintainer identity, and dependency changes before upgrades. Re-review every version change. 5. Run the MCP server under a dedicated, least-privileged account or sandbox with access limited to required files and network destinations. 6. Scope the API key to the minimum permissions available, avoid placing it in project files that may be committed, and rotate it immediately if package compromise is suspected. 7. Prefer project-level MCP configuration over user-global configuration where practical, reducing the number of projects and sessions in which the server is automatically available. ]]>

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json
{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# setlist-mcp

MCP server for setlist.fm — search concert setlists, artists, venues, and tours via natural language. Read-only (setlist.fm has no write API).

- **npm:** [npmjs.com/package/setlist-mcp](https://www.npmjs.com/package/setlist-mcp)
- **Source:** [github.com/chrischall/setlist-mcp](https://github.com/chrischall/setlist-mcp)

Static analysis

No suspicious patterns detected.